# APT27

> As of 2026-07-19, APT27 is a China-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning vulnerability, apt. Also known as Linen Typhoon, Altered Spider. ATT&CK coverage spans 39 techniques across 15 tactics in 2 of 2 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1059 (Command and Scripting Interpreter), T1071 (Application Layer Protocol).

- **Nation:** China
- **Tracked threats:** 2
- **Categories:** VULNERABILITY, APT
- **Also known as:** Linen Typhoon, Altered Spider
- **As of:** 2026-07-19

## ATT&CK techniques observed

39 techniques observed across 2 of 2 tracked threats. Tactics: Command and Control (5), Credential Access (5), Initial Access (4), Resource Development (4), Stealth (formerly Defense Evasion) (4), Discovery (3).

- [T1027](https://attack.mitre.org/techniques/T1027/) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1059](https://attack.mitre.org/techniques/T1059/) Command and Scripting Interpreter — Execution — observed in 2 of 2 tracked threats
- [T1071](https://attack.mitre.org/techniques/T1071/) Application Layer Protocol — Command and Control — observed in 2 of 2 tracked threats
- [T1078](https://attack.mitre.org/techniques/T1078/) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1082](https://attack.mitre.org/techniques/T1082/) System Information Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1190](https://attack.mitre.org/techniques/T1190/) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1552](https://attack.mitre.org/techniques/T1552/) Unsecured Credentials — Credential Access — observed in 2 of 2 tracked threats
- [T1588](https://attack.mitre.org/techniques/T1588/) Obtain Capabilities — Resource Development — observed in 2 of 2 tracked threats
- [T1005](https://attack.mitre.org/techniques/T1005/) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1021](https://attack.mitre.org/techniques/T1021/) Remote Services — Lateral Movement — observed in 1 of 2 tracked threats
- [T1041](https://attack.mitre.org/techniques/T1041/) Exfiltration Over C2 Channel — Exfiltration — observed in 1 of 2 tracked threats
- [T1056](https://attack.mitre.org/techniques/T1056/) Input Capture — Credential Access — observed in 1 of 2 tracked threats
- [T1068](https://attack.mitre.org/techniques/T1068/) Exploitation for Privilege Escalation — Privilege Escalation — observed in 1 of 2 tracked threats
- [T1083](https://attack.mitre.org/techniques/T1083/) File and Directory Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1090](https://attack.mitre.org/techniques/T1090/) Proxy — Command and Control — observed in 1 of 2 tracked threats

## Tracked threats

- [Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164)](https://intel.threadlinqs.com/threat/TL-2026-1336) — CRITICAL
- [GTIG AI Threat Tracker (May 2026) — First AI-Developed Zero-Day Exploit (2FA Bypass), PROMPTFLUX/HONESTCUE/CANFAIL/LONGSTREAM/PROMPTSPY AI-Enabled Malware, and APT27/APT45/UNC2814/UNC5673/UNC6201/TeamPCP AI-Augmented Operations](https://intel.threadlinqs.com/threat/TL-2026-0495) — HIGH

## Related CVEs

22 CVEs referenced by tracked APT27 activity.

- [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644)
- [CVE-2026-57092](https://intel.threadlinqs.com/cve/CVE-2026-57092)
- [CVE-2026-56190](https://intel.threadlinqs.com/cve/CVE-2026-56190)
- [CVE-2026-56188](https://intel.threadlinqs.com/cve/CVE-2026-56188)
- [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164)
- [CVE-2026-56155](https://intel.threadlinqs.com/cve/CVE-2026-56155)
- [CVE-2026-55944](https://intel.threadlinqs.com/cve/CVE-2026-55944)
- [CVE-2026-55010](https://intel.threadlinqs.com/cve/CVE-2026-55010)
- [CVE-2026-55008](https://intel.threadlinqs.com/cve/CVE-2026-55008)
- [CVE-2026-54992](https://intel.threadlinqs.com/cve/CVE-2026-54992)
- [CVE-2026-54128](https://intel.threadlinqs.com/cve/CVE-2026-54128)
- [CVE-2026-54127](https://intel.threadlinqs.com/cve/CVE-2026-54127)
- [CVE-2026-50680](https://intel.threadlinqs.com/cve/CVE-2026-50680)
- [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661)
- [CVE-2026-50655](https://intel.threadlinqs.com/cve/CVE-2026-50655)
- [CVE-2026-50522](https://intel.threadlinqs.com/cve/CVE-2026-50522)
- [CVE-2026-50518](https://intel.threadlinqs.com/cve/CVE-2026-50518)
- [CVE-2026-50444](https://intel.threadlinqs.com/cve/CVE-2026-50444)
- [CVE-2026-50392](https://intel.threadlinqs.com/cve/CVE-2026-50392)
- [CVE-2026-50370](https://intel.threadlinqs.com/cve/CVE-2026-50370)
- [CVE-2026-50327](https://intel.threadlinqs.com/cve/CVE-2026-50327)
- [CVE-2026-42982](https://intel.threadlinqs.com/cve/CVE-2026-42982)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/APT27